Description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Remediation
References
https://github.com/thenables/thenify/blob/master/index.js%23L17
https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
Related Vulnerabilities
CVE-2022-34115 Vulnerability in maven package io.dataease:dataease-plugin-common
CVE-2020-36732 Vulnerability in maven package org.webjars.bowergithub.brix:crypto-js
CVE-2022-41642 Vulnerability in npm package nadesiko3
CVE-2020-13445 Vulnerability in maven package com.liferay:com.liferay.portal.template.velocity
CVE-2021-34428 Vulnerability in maven package org.eclipse.jetty:jetty-server